Security
How to report a vulnerability
Privately, with the exact version, the steps and the impact. Here is what you get back, before you send it.
Privately, never in public
Report suspected vulnerabilities through GitHub Private Vulnerability Reporting for this repository. If that route is unavailable, email dev@openlup.com.
Credit, not a bounty
OpenLup does not run a bug bounty and does not pay for vulnerability reports.
Specific, reproducible, verified
- Specific
- A weakness in this codebase, with the exact version or commit. A theoretical class of problem without an instance here is not a report.
- Reproducible
- The steps that trigger it, and the concrete impact.
- Verified
- A scanner's output pasted without verification is not a report. Verify it yourself first.
- Disclosed
- If an AI tool helped you find or write it, say so.
Which code receives fixes
During development preview
OpenLup-owned core and official-experimental code on the default branch or an exact immutable source preview may receive best-effort fixes, without support or backport commitment.
Community and private modules
They remain contributor- and adopter-owned, even when used with an OpenLup preview or stable release.
After the stable release
Committed maintenance applies only to core and official-stable modules present in the exact supported release and version window.
Outside the window
Official-experimental modules stay best-effort beside a stable release, and stable versions outside the window receive no fixes.